It’s quite easy to chroot bind9 and apache on Debian. (See this page for bind9 and libapache2-mod-chroot or libapache2-mod-security for apache.)

But I’ve found no guide for chrooting MySQL, so here’s my short recipe:

• Prepare the chroot directory. It’s recommended to use an extra partition/filesystem for it. I will use /srv/mysql (which is an LVM2 partition with an ext3 filesystem on my system) for the rest of the text.
• Stop MySQL:
  /etc/init.d/mysql stop
• Copy the databases to new location:
  mkdir -p /srv/mysql/var/lib
  cp -a /var/lib/mysql /srv/mysql/var/lib
• Copy this script to /etc/default/mysql-chroot
• Edit /etc/init.d/mysql:
  • Source the mysql-chroot script somewhere at the top:
    …
    test -x /usr/sbin/mysqld || exit 0

    . /etc/default/mysql-chroot

    SELF=$(cd $(dirname $0); pwd -P)/$(basename $0)
    …

  • Run setup_chroot right in the start section:
    …
    if mysqld_status check_alive nowarn; then
    echo "...already running."
    else
    setup_chroot
    /usr/bin/mysqld_safe > /dev/null 2>&1 &
    …
  • Somehow /var/run/mysqld/mysqld.pid disappears after each start. We have to create it each time, otherwise the stop command won’t work properly:
    …
    if mysqld_status check_alive warn; then
    echo "."
    ln -sf $CHROOT_DIR/var/run/mysqld/mysqld.pid \
    /var/run/mysqld
    # Now start mysqlcheck or whatever the admin wants.
    /etc/mysql/debian-start
    …
• In /etc/mysql/debian.cnf, change the socket line to:
  socket = /srv/mysql/var/run/mysqld/mysqld.sock
• In /etc/mysql/my.cnf:
  • Change the socket line in the [client] section to:
    socket = /srv/mysql/var/run/mysqld/mysqld.sock

    Don’t change the socket lines in the other sections!

  • Add
    chroot = /srv/mysql

    to the [mysqld] section.

• Prepend /srv/mysql to the log files listed in /etc/logrotate.d/mysql-server
• Start MySQL:
  /etc/init.d/mysql start
• Check /var/log/syslog for errors ;-)

March 13th, 2005: I’ve updated the script for newer Debian packages, see Updated MySQL Chroot Script for more information.

July 30th, 2006: These modifications still work fine on the current stable Debian release (3.1, “sarge”). The mysql packages in the testing (”etch”) and unstable (”sid”) distributions of Debian need a few additional changes, I’ll post an updated guide in a few days.

December 30th, 2006: I’ve made an updated guide on how to chroot more recent MySQL packages on Debian and Ubuntu